PT-2026-1699 · WordPress · Folders – Unlimited Folders To Organize Media Library Folder

Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-12640

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress versions up to and including 3.1.5

Description The Folders plugin for WordPress is susceptible to unauthorized arbitrary media replacement. This occurs because of a lack of proper object-level authorization checks within the handle folders file upload() function. Authenticated attackers possessing Author-level access or higher can exploit this to replace any media file within the WordPress Media Library.

Recommendations Versions prior to and including 3.1.5 should be updated to a newer, fixed version of the plugin. As a temporary workaround, consider restricting access to the handle folders file upload() function for users with Author-level access or below.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12640

Affected Products

Folders – Unlimited Folders To Organize Media Library Folder

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12640 · Security Note
• https://t.me/CVEtracker/41674 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3402986/folders/tags/3.1.6/includes/media.replace.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2009121798563017040 · Twitter Post
• https://twitter.com/CVEnew/status/2009149974282719398 · Twitter Post
• https://t.me/cveNotify/148039 · Telegram Post